Security In development
Security, without adjectives.
What we do, how we do it, and what we still lack. A proof is only worth as much as the chain protecting it.
Four rules we do not negotiate.
- 01
Everything leaves a trace.
Every call, inbound and outbound, every change and every human access is logged.
- 02
History is not rewritten.
Records, evidence and consents are immutable. A correction creates a new version that points to the previous one.
- 03
The proof is checked without us.
Fingerprint, timestamp and signature are verified publicly, by reference or by file, even offline.
- 04
Every customer, in its place.
A customer never sees another’s data: not in the dashboard, not in the logs, not in the metrics.
Platform
What is underneath.
- Isolation
- Strict multi-tenancy: the account comes from authentication, never from the request. Automated isolation tests on every endpoint.
- Encryption
- TLS in transit. At rest, AES-256-GCM for sensitive fields and file-by-file encryption of evidence, with key rotation.
- Access
- Argon2id passwords, mandatory 2FA for owners and admins, sessions with remote sign-out and alerts on new sign-ins.
- API keys
- Test or live prefix, only their fingerprint is stored and they are shown once. Scopes, allowed IPs, expiry and rotation with overlap.
- Limits
- Per IP, per key and per account, stricter on sign-in and public verification. Progressive lock-out after failures.
- Chained audit trail
- An insert-only log where each event carries the fingerprint of the previous one, anchored daily. It includes our support team’s access.
- Backups
- Encrypted nightly backups away from the web server, and a restore test every month.
- Retention
- Configurable per account, never below your legal obligation. Legal hold per transaction or per account.
- Region
- Data and evidence in the European Union by default.
- Minimal personal data
- The record carries what proves the parcel. The end recipient, only if you send it and with the retention you choose.
Secure capture · Web, Android and iOS Coming soon
So a phone photo is worth as much as a station’s.
The most dangerous attack is not editing an image. It is slipping one straight into the capture flow, bypassing the camera. Know Your Parcel’s capture SDKs are built against that.
- 01Attested device
- 02Key in the enclave
- 03Encrypted channel
- 04Server verifies
- 05Trust level
Environment attestation
Play Integrity on Android, App Attest on iOS and WebAuthn on the web when required. Without a valid attestation there is no capture session, or it is marked as degraded.
Keys that never leave the device
Generated in Android Keystore, in the Secure Enclave or as a non-exportable browser key. Every request is signed with a single-use nonce.
A doubly closed channel
TLS with public-key pinning in native apps and, on top, HPKE encryption of the content towards the vault: not even an intercepting proxy can read it.
A live camera, for real
Direct camera access, no gallery. Detection of virtual cameras, emulators, root or jailbreak, debuggers, hooking and screen recording.
Challenge-response
A light pattern, a guided movement or an ephemeral code that must appear in the scene itself. Frames are signed as they are captured.
C2PA provenance
A Content Credentials manifest signed on the device travels with the image and is checked on the server.
Kill switch
SDK integrity checks, a mandatory minimum version and remote blocking of a compromised version.
Attacks in plain sight
Every detected attempt feeds the risk engine and shows up in your dashboard, with no personal data.
Every capture says how far to trust it.
The level is written into the record and shown on public verification. Whoever checks it knows where the image comes from.
attestedAttestedDevice and app checked, valid signature.signedSignedValid signature, no environment attestation.degradedDegradedSomething did not add up. Sealed, with a warning.rejectedRejectedInvalid signature. Quarantined and never sealed.
The PackNSign station does the same with its own hardware: an Ed25519 signature on every record and image, a monotonic sequence and an on-screen challenge. A capture without a valid signature is never sealed.
What we still lack.
We would rather say it before you ask.
External penetration testPlanned
Before opening the platform to third parties and before publishing the SDKs in the app stores.
Responsible disclosurePlanned
A public programme so whoever finds a flaw can tell us, and knows what we do about it.
ISO 27001 and SOC 2Goal
They are the goal, not a logo. We do not hold them. We work with their controls from day one so we can be audited against them.
Status pagePlanned
Availability, latency and incidents, published.